== PRISTINE production ppbconf.c, fresh-boot decisive run (run4) ==
Probing for PnP devices on ppbus1:
Probing for PnP devices on ppbus0:
ppb: <PnP> 256 characters: A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) A(0x41) C(0x43) L(0x4c) S(0x53) :(0x3a) Q(0x51) Q(0x51) A(0x41) ;(0x3b) 
ppbus0: <unknown unknown> QQA
Probing for PnP devices on ppbus2:
PPBX2: --- DF-5510 search_token(class, len) length confusion ---
PPBX2: DF-5510 Ta in-bounds cross-field: ID "CLS:QQ;CMD:PRINTER;" class_value=QQ -> class_id=0 (PRINTER)  [correct: 10 UNKNOWN; buggy: 0 PRINTER]
PPBX2: DF-5510 Tb OOB: 256-byte ID, CLS: at 248, class=str+252, scan window str[252..507] (251 bytes past the 257-byte str[] object); stack pre-dirtied with class tokens
PPBX2: DF-5510 Tb OOB result: class_id=1 (MODEM)  [correct: 10 UNKNOWN; any 0..9 = token matched in uninitialized/out-of-bounds stack bytes]
PPBX2: Tb dirt-survival map below sp=0xfffff801166db977: PRINTER@-1634 PORTS@-1615 MODEM@-164 NET@-1579 FDC@-1564
PPBX2: DF-5510 Tc control (short ID, same dirt): class_id=10 (UNKNOWN) [expect 10 UNKNOWN]

== variance across the other pristine runs ==
DF-5510 Ta: PRINTER(0) wrong 4/4; Tb: MODEM(1) from OOB bytes 4/4; Tc control UNKNOWN 4/4
DF-5511 wrong-captures per 50M iters: 2,1,1,6
DF-5512/DF-5513 reproduced 4/4